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SENSOR, CONTROL UNIT, AND METHOD FOR MONITORING AT LEAST 

ONE SENSOR 



Background Information 

The invention proceeds from a sensor and a control unit and a 
method for monitoring at least one sensor according to the 
5 species defined in the independent claims. 

Advantages of the Invention 

The sensor according to the present invention and control unit 

10 according to the present invention and method for monitoring 
at least one sensor according to the present invention having 
the features of the independent claims have the advantage that 
a differentiated fault pattern can be transmitted with a 
specific fault message to the system i.e. to the control 

15 unit and an appropriate reaction can occur, while 

preventing every fault in a sensor from having the consequence 
that the sensor signal as a whole must not be used, or that 
the system identifies a permanent sensor fault and therefore a 
system defect. Disruptions that do not denote lasting sensor 

2 0 damage, and possibly are even attributable to infrequent but 
possible operating states, can therefore be not too severely 
punished. Examples of this are the incoupling of 
electromagnetic interference, and vibrations due to hammer 
blows. The performance or sensitivity of the system is thereby 

25 improved, and the probability of a control unit field failure 
is reduced. The invention in particular makes it possible, 
with adaptation and application to the respective target 
control unit and vehicle, to react better to specific 
differing system requirements and customer requirements in 
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terms of triggering parameters and fault management. 

This allows on the one hand an increase in the performance and 
robustness of the overall system, and on the other hand a 
5 reduction in field failure fates, since with the more in-depth 
fault pattern detection not all fault patterns must be deemed 
total failures. The invention is additionally advantageous 
because fault discovery and optimization can be facilitated in 
the development and testing phase of a restraint system. 
10 Application of the invention is also possible and advisable, 
however, in other automotive sectors in which sensors are 
used, in particular in vehicle dynamics control and in 
navigation . 

15 The features and refinements set forth in the dependent claims 
make possible advantageous improvements to the sensor, control 
unit, and method for monitoring at least one sensor recited in 
the independent claims. 

20 It" is particularly advantageous that the status bits 

indicating the fault modes are constituted from different 
sensor- internal monitoring mechanisms, and remain in existence 
only until a conclusion is drawn as to the operating state 
belonging to the fault state. The time information for each 

25 individual fault mode is thus also usable for system-side 

application of the sensor. This permits an accurate analysis 
of the fault, achievable using a so-called look-up table. The 
fault pattern transmitted from the sensor to the control unit 
can then be evaluated accordingly in the processor of the 

30 control unit. It is thereby possible, in particular, for the 
control unit to detect whether the fault is permanent and how 
serious the fault is. 

It is especially advantageous that the fault pattern is 
35 transmitted digitally in an eight-bit word, here given the 

abbreviation MONI , in a 16-bit frame. The MONI word can have 
different fault indications written to it using different read 
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instructions . The number of transmittable fault modes can 
thereby be increased. In this word, the fault type or modes 
are identified by flags. A variety of fault modes and unusual 
operating states that have been detected are thus indicated by 
5 way of this word. Fault modes indicate that at least one 
sensor operating parameter is outside a predefined range. 



In the context of this monitoring, advantageously at least one 
phase- lock loop of the sensor and/or at least one control 

10 voltage is monitored in terms of a predefined range, and/or 

the output values of at least one analog/digital converter are 
monitored in terms of a predefined range, and/or the input 
and/or output values of at least one digital/analog converter 
are monitored in terms of a predefined range, and/or the 

15 dynamic limits of at least one capacitance/voltage converter 
are monitored in terms of a predefined range, and/or at least 
one offset controller is monitored in terms of a predefined 
range, and/or at least one common-mode controller is monitored 
in terms of departure from a predefined range, and/or at least 

2 0 one variable representing a sensor oscillation is monitored in 
terms of a predefined range, and/or impermissible values of at 
least one counter are monitored as defined. When a fault or an 
unusual operating state is detected, a respective value is set 
in a respective register, i.e. a fault register is occupied by 

25 a logical "1". When that fault or unusual operating state is 
no longer detected, the respective register is then reset, 
i.e. a logical "0" is once again set. 

When at least one value that denotes a fault is set to "1", 
30 another value is also set to one. This makes it possible to 
indicate, by way of a single bit or flag, whether any 
sensor- internal fault has been identified. This flag is 
transmitted as status information along with every regular 
sensor output value transmission. If necessary, i.e. in the 
35 event the summarizing value indicates a fault state, the 

detailed fault pattern can then be requested by way of the 
available read instructions. This procedure of requesting as 
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necessary saves transmission and processing capacity. The 
allocation of read instructions numbered 1, 2, etc. to the 
fault information is defined in the MONI word. Two read 
instructions are used here, i.e. two eight -bit words of fault 
information can be indicated. 

It is additionally advantageous that the sensor itself is 
disposed inside the housing of the control unit. SPI (serial 
peripheral interface) lines are then preferably used to 
interconnect the sensor (via the digital interface) and the 
processor of the control unit . 

Drawing ' 

Exemplary embodiments of the invention are depicted in the 
drawings and will be explained in more detail in the 
description below. 

The figures show: 

Figure 1 a block diagram of the sensor according to the 

present invention in a control unit according to the 
present invention; and 

Figure 2 a data telegram according to the present invention. 

Description 

Rotation rate sensors, like other sensors as well, are being 
used more and more in electronic restraint systems for passive 
vehicle safety. Rotation rate sensors are core components for 
the detection of rollover processes and related accident 
processes, for example soil trip. 

Some of the sensors used in restraint systems possess a 
sensor- internal monitoring function. A fault or malfunction 
state resulting from a wide variety of causes can, when it is 
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identified, be reported by way of a logical signal (fault, no 
fault) , in a context of analog sensor interfaces, to the 
system, to a sensor platform, to a control unit that is 
generally a microcontroller, or to a safety semiconductor. 

5 

Digital sensors offer the capability, relatively easily 
implemented in technical terms, of transmitting various faults 
and malfunction states to the system by way of permanently 
assigned bits in data words. Each bit has associated with it a 

10 fault flag, which in turn is associated with a sensor- internal 
circuit block or a sensor-internal monitoring variable or 
measured variable. The sensor- internal monitoring function 
generally responds when one of the various sensor- internal 
control voltages or control variables being monitored enters 

15 the limits of its respective dynamic range or is beyond 

design-related value ranges, or when offset values are outside 
permissible ranges, or when a phase- lock loop drops out of 
synchronization, or when counters are found to have an 
overflow or impermissible values. Monitoring is generally 

2 0 performed by way of window comparators or by evaluating the 
analog/digital converter output or the digital/analog 
converter input word. There are thus a wide variety of causes 
in terms of the sensor evaluation circuit function blocks. 

25 Possible causes of malfunction or fault states: 

In rotation rate sensors used in automotive systems, 
vibrational or mechanical disturbance sensitivity is a matter 
of functional principle and is a characteristic property that 

30 must be accounted for in the sensor application. If there is 
no mechanical damping, the performance of these systems is 
limited. A mechanical damper assemblage means a considerable 
additional outlay in terms of development, cost, and 
production. Impacts or severe vibrations can disrupt the 

35 sensor element so much that the sensor- internal control 

systems can no longer engage for a certain period of time, and 
the sensor ends up outside its specified functional range. 
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Further possible disturbances are, for example, incoupled 
electromagnetic interference. Faults in the sensor itself or 
in the application wiring can likewise impair system 
operation. The effects differ depending on the rotation rate 
5 sensor fault and the kind of disturbance, and also depending 
on the application environment of the sensor, i.e. the wiring 
and circuit board and the vehicle construction. 

The rotation rate sensor monitoring function has hitherto been 
10 used on the system side only for basic fault detection, i.e. 
is the sensor OK or not. As regards its reaction, the 
restraint system at most distinguishes by way of the duration 
of the fault message whether or not a failure of the rotation 
rate sensor exists. That absent, an application in terms of 
15 coordinating the respective system reaction to the various 
fault messages does not take place. 

Since no classification of different fault patterns is 
performed on the system side, and the application environment 

20 also is not incorporated, the principle of "assuming the 
worst" must be invoked. When the monitoring function 
identifies a state as faulty, the consequence is that the 
sensor signal must not be used, or that the system concludes 
that a permanent sensor fault and therefore a system defect 

25 exists. Malfunctions that do not signify lasting sensor damage 
and are possibly attributable to infrequent but possible 
operating states are therefore generally punished too 
severely. This limits the performance or sensitivity of the 
. systems, or increases the probability of a possibly 

30 unnecessary control unit field failure. 

According to the present invention, a fault pattern that 
contains the combination of different fault modes is therefore 
transmitted from the sensor to the system, preferably a 
35 processor of the control unit, thus conveying to the system 

accurate information about the nature and cause of the fault. 
An appropriate reaction by the system to that fault is then 
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therefore possible . 

The fault patterns that occur in response to various fault and 
malfunction causes are already determined in the development 
5 and application phase of restraint system electronics systems. 
With the availability of a look-up table, the system can react 
properly to the particular fault pattern. 

A practical prerequisite for implementation of the invention 
10 is a digital sensor interface. Only with this can a large 

number of different faults and malfunction modes or patterns, 
as well as combinations thereof, be transmitted to the system 
with reasonable outlay. The bidirectional SPI (serial 
peripheral interface) is used here as an example of an 
15 interface. In this context, for example, two instructions 

RD_MONITOR_I and RD_MONI TOR_I I are provided for reading out 
the various fault modes, the modes themselves being identified 
by way of flags in the MONI word transmitted back in each 
case. The word having eight zeroes, for example, means here 

2 0 that the monitored sensor parameter is within specified 

operating ranges, and an unusual operating state does not 
exist. The following faults can be indicated by coding: 

The capacitance/voltage converter in which the measured 
25 variable is mapped by way of the sensor principle into a 

capacitance or a capacitance change is outside its predefined 
range; the value at the analog/digital converter in the drive 
path, which is an oscillating sensor, is outside its 
predefined range; the phase-lock loop is not synchronized; the 

3 0 offset controller is outside its predefined range; the sum 

value and/or difference value of the common-mode control 
circuit in the drive circuit and/or in the detection circuit 
is outside its predefined range; the amplitude of the sensor 
oscillation is outside its predefined range. The drive circuit 
35 of a rotation rate sensor serves to generate a defined (i.e. 
usually regulated) oscillating or rotational motion with 
which, in the presence of a rotation rate, a measurable effect 
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(for example, a deflection of a micromechanical structure 
orthogonally to that motion) is generated using e.g. the 
principle of conservation of angular momentum. This effect is 
measured or sensed, and processed, in the detection circuit. 

5 

In addition to these fault indications, an unusual operating 
state can be indicated if the rotation rate value that is 
present exceeds or falls below the measurement range of the 
sensor, and the value must be mapped onto the maximum or 
10 minimum value that can be represented. 

Figure 1 shows the sensor and the control unit according to 
the present invention in a block diagram. Located in a control 
unit 10 is a sensor 1 that is connected via a digital line 6 
15 to a processor 7. Processor 7 is connected via a data 

input/output to a memory 8. Processor 7 is connected via a 
data output to the remainder of restraint system 9. A 
so-called safety semiconductor 11, i.e. a further processor or 
a monitoring circuit that also evaluates the sensor output 

2 0 values and can influence the enabling of restraint means, can 

be connected to digital line 6. Located in sensor 1 is a 
sensor element 2 for acquiring a measured variable, e.g. 
rotation rates or rotational accelerations. The sensor element 
can chiefly be a micromechanical sensor structure in which 
25 drive and detection occur capacitatively . Sensor element 2 is 
connected to a functional and monitoring module 3 where 
capacitance/voltage conversion, analog/digital conversion of 
the sensor signal, driving and regulation of the sensor 
oscillation, and sensor-internal monitoring functions can be 

3 0 implemented. Functional and monitoring module 3 is connected 

via a data output to a transmitter module 4. Transmitter 
module 4 is connected to digital line 6, which is embodied 
here as a so-called SPI (serial peripheral interface) line. 

3 5 Functional and monitoring module 3 thus also performs 

monitoring functions in sensor 1. The measured values are 
conveyed to transmitter module 5. At a cycling rate 
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predefined by the sensor circuit timing cycle, the fault 
patterns are continuously updated and can be continuously 
queried. The measured values in sensor 1 are incorporated into 
this fault pattern. 

5 

Figure 2 schematically shows a data frame of the requested 
16 -bit MISO word, which is subdivided into a first part 12 and 
a second part 11. The respective fault word 11 (MONI) is 
transmitted in second part 11. Two fault words, which can be 

10 read out using different MOSI instructions, can be transmitted 
here. This can occur cyclically or only when necessary. That 
necessity is indicated in the standard rotation rate 
transmission by setting a bit that indicates an unusual 
operating state. That bit is set when at least one indicatable 

15 fault instance is deemed to exist. 

Sensor 1 can also, alternatively, be located outside control 
unit 10. Instead of only one sensor 1, several sensors, 
possibly of different kinds, can also be used and monitored. 
20 In addition to the restraint system discussed here, other 
vehicle systems are also suitable for this invention, for 
example a vehicle dynamics system or a navigation system. 



NY01 722591 v 1 



